===========================================================
Malware Cookbook DVD Tools Online
===========================================================
For all the folks who bought DVD-less Kindle versions of the cookbook, all the folks who received a DVD with their paper copy but want updates to the tools, and even for folks who just want to experiment with the tools without buying the book, please feel free to download with an SVN client here:
http://code.google.com/p/malwarecookbook/
In order by Chapter, here's a quick description of what's on the DVD. It also includes malware.py, the set of Volatility plugins for the upcoming 1.4 release, a bunch of sample memory dumps from malware infected systems, and full color images for screen shots in the book.
* torwget.py: Multi-platform TOR-enabled URL
* wwwhoney.tgz: CGI scripts to accept submissions from nepenthes and dionaea honeypots
* clamav_to_yara.py: Convert ClamAV antivirus signatures to YARA rules
* peid_to_yara.py: Convert PEiD packer signatures to YARA rules
* av_multiscan.py: Script to implement your own antivirus multi-scanner
* pescanner.py: Detect malicious PE file attributes
* ssdeep_procs.py: Detect self-mutating code on live Windows systems using ssdeep
* avsubmit.py: Command-line interface to VirusTotal, ThreatExpert, Jotti, and NoVirusThanks
* dbmgr.py: Malware artifacts database manager
* artifactscanner.py: Application to scan live Windows systems for artifacts (files, Registry keys, mutexes) left by malware
* mapper.py: Create static PNG images of IP addresses plotted on a map using GeoIP
* googlegeoip.py: Create dynamic/interactive geographical maps of IP addresses using Google charts
* sc_distorm.py: Script to produce disassemblies (via DiStorm) of shellcode and optionally apply an XOR mask
* vmauto.py: Python class for automating malware execution in VirtualBox and VMware guests
* mybox.py: Sample automation script for VirtualBox based on vmauto.py
* myvmware.py: Sample automation script for VMware based on vmauto.py
* analysis.py: Python class for building sandboxes with support for analyzing network traffic, packet captures, and memory
* RegFsNotify.exe: Tool to detect changes to the Registry and file system in real time (from user mode without API hooks)
* HandleDiff.exe: Tool to detect changes to the handle tables of all processes on a system (useful to analyze the side-effects of code injecting malware)
* Preservation.zip: Kernel driver for monitoring notification routines, preventing processes from terminating, preventing files from being deleted, and preventing other drivers from loading
* cmd.exe: Custom command shell (cmd.exe) for logging malware activity and backdoor activity
* tsk-xview.exe: Cross-view based rootkit detection tool based on The Sleuth Kit API and Microsoft's Offline Registry API
* HTMLInjection Detector.exe: Detect HTML injection attacks on banking and financial websites
* routes.pl: RegRipper plug-in for printing a computer's routing table
* pendingdelete.pl: RegRipper plug-in for printing files that are pending deletion
* disallowrun.pl: RegRipper plug-in for printing processes that malware prevents from running
* shellexecutehooks.pl: RegRipper plug-in for printing ShellExecute hooks (a method of DLL injection)
* dumpcerts.pl: Parse::Win32Registry module to extract and examine cryptography certificates stored in Registry hives
* somethingelse.pl: Parse::Win32Registry module for finding hidden binary data in the Registry
* scloader.exe: Executable wrapper for launching shell code in a debugger
* scd.py: Immunity Debugger PyCommand for finding shellcode in arbitrary binary files
* findhooks.py: Immunity Debugger PyCommand for finding Inline-style user mode API hooks
* pymon.py: WinAppDbg plug-in for monitoring API calls, alerting on suspicious flags/parameters and producing an HTML report
* xortools.py: Python library for encoding/decoding XOR, including brute force methods and automated YARA signature generation
* trickimprec.py: Immunity Debugger PyCommand for assistance when rebuilding import tables with Import REconstructor
* kraken.py: Immunity Debugger PyCommand for cracking Kraken's Domain Generation Algorithm (DGA)
* sbstrings.py: Immunity Debugger PyCommand for decrypting Silent Banker strings
* rundll32ex.exe: Extended version of rundll32.exe that allows you to run DLLs in other processes, call exported functions, and pass parameters
* install_svc.bat: Batch script for installing a service DLL (for dynamic analysis of the DLL)
* install_svc.py: Python script for installing a service DLL and supplying optional arguments to the service
* dll2exe.py: Python script for converting a DLL into a standalone executable
* DriverEntryFinder: Kernel driver to find the correct address in kernel memory to set breakpoints for catching new drivers as they load
* windbg_to_ida.py: Python script to convert WinDbg output into data that can be imported into IDA
* WinDbgNotify.txt: WinDbg script for identifying malicious notification routines
===========================================================
Reviews, News, and Errata
===========================================================
Reviews
We've very excited about the 5-star reviews on Amazon, which you can read about here. Thank you to the readers who took the time to let others know their thoughts. There are a few other reviews available as well:
* Netsec Redditors discuss and share comments about the book: http://www.reddit.com/r/netsec/comments/gdzbv/this_book_should_be_on_all_of_rnetsecs_reading/
* Harlan Carvey explains how to install pescanner.py on Windows: http://windowsir.blogspot.com/2010/12/installing-pescannerpy-on-windows.html
* Book Review: Malware Analyst's Cookbook by Harlan Carvey: http://windowsir.blogspot.com/2010/12/book-review-malware-analysts-cookbook.html
* A view on the Malware Analysis Cookbook by wishi: http://crazylazy.info/blog/content/view-malware-analysis-cookbook
* Lenny Zeltser's How to Get Started With Malware Analysis: http://blogs.sans.org/computer-forensics/2010/11/12/get-started-with-malware-analysis/
* Review by Richard Austin at ieee-security.org: http://www.ieee-security.org/Cipher/BookReviews/2010/Ligh_by_austin.html
* Blog post by David Sharpe from Sharpe Security: http://blog.sharpesecurity.com/2010/10/28/get-3500-idefense-advanced-malware-class-for-price-of-a-single-book/
* Book of the Month Nov 2010 on SecurityXploded.com: http://nagareshwar.securityxploded.com/2010/11/26/book-of-the-month-malware-analysts-cookbook/
* Book Review by Dustin Schultz on TheXploit Security Blog: http://www.thexploit.com/reviews/book-review-malware-analysts-cookbook-and-dvd/
* RCE Endeavors calls MACB "very thorough and up-to-date": http://www.codereversing.com/blog/?p=65
* SpiderLabs calls MACB "a great book": http://blog.spiderlabs.com/2011/05/analyzing-malware-hollow-processes.html
Analysis using Tools in MACB:
* Lenny Zeltser's REMnux includes pescanner.py and xortools.py: http://zeltser.com/remnux/
* Undead Security uses pescanner.py to analyze Windows executables: http://www.zonbi.org/archives/495
* Malware Analysis with ClamAV and YARA @ Infosec Institute by Mourad Ben Lakhoua. This article was heavily based on Chapter 3 of MACB – thanks for the reference Mourad!: http://resources.infosecinstitute.com/malware-analysis-clamav-yara/
* Debugging Fundamentals for Exploit Development @ Infosec Institute by Steven Bradshaw. There's no reference in this one, but you can tell the introduction was based on Chapter 11 of MACB: http://resources.infosecinstitute.com/debugging-fundamentals-for-exploit-development/
News
If you purchased a Kindle version of the book from Amazon and didn't receive the companion DVD, send us an email: malwarecookbook at gmail dot com. Neither Wiley nor Amazon have a way to distribute CDs or DVDs with electronic books.
Stefan from Joebox Security has updated the online version of Joebox reports (version 2.6.0) with static PE file analysis, inspired by the PEScanner module in Chapter 3 of Malware Analyst's Cookbook. You can see a sample report here: http://www.joebox.org/resources/result%202.6.0.html
We received notification from the publisher that the book will be soon be translated into Korean.
===========================================================
Errata
===========================================================
We will update the following table with fixes as they are discovered. If you see any spelling mistakes, code mistakes, or disagree with any statements, feel free to let us know so we can disperse that information to other readers.
Page Description
43 The text "Analyzing and Replaying Attacks Logged by Dionea" should read "...by Dionaea"
57 The text "0000000C jmp 0xc" should be "0000000C jmp $+0xc" – thanks to Matthieu Suiche for pointing this out.
64 The capabilities.yara file on the DVD has a typo. In particular, the condition for the encoding rule should be "(all of ($zlib*)) or (all of ($ssl*))" Note: this is only incorrect on the DVD file, it is correct in the book's text.
119 The text "The domains and IP addresses that malware uses can you tell you a lot" should read "The domains and IP addresses that malware uses can tell you a lot"
194 The text "OfficeMalScaner" should read "OfficeMalScanner"
304-305 Step 1 should state "Download, install, and build Detours" instead of just "Download and install Detours." If you don't build Detours, then the detours.lib won't be available when you reach Step 4. For instructions on how to build Detours, see the documentation that comes with Detours.
306-307 The 2nd parameter to DetourAttach and DetourDetach should be HookDeleteFileA instead of DeleteFileA. Note: the corresponding source file on the DVD contains the correct parameters – we must have made an error when copy/pasting the code into the book.
442 In table 12-2 the header should read "(X ^ Y) ^ Y" and not "(X ^ Y) ^ X"
451 The two instances of "decoded = base64.b64encode" should read "decoded = base64.b64decode"
483 "areguments" should be "arguments"
529 Matthieu Suiche sent us an optimized version of the WinDbg command that doesn't rely on hard-coded offsets (thus you can use it on any platform). Here is the command: !list "-t nt!_EPROCESS.ActiveProcessLinks.Flink -e -x \"dt nt!_EPROCESS ImageFileName\"(poi(nt!PsActiveProcessHead)-@@c++(#FIELD_OFFSET(nt!_EPROCESS,ActiveProcessLinks)))"